ERP Fraud Files, Part 7: The Payroll Deduction Nobody Was Supposed to Question

Brigit Marshall ran payroll and HR for a Minnesota company that sells trucks, parts, and service, and for eight years she paid herself through a line item designed to take money away from employees, not hand it to anyone. She was sentenced on September 22, 2026, to 21 months for wire fraud, after pleading guilty that May. The company lost more than $1.2 million. The scheme started in 2017.

What happened

Marshall created fictitious wage garnishments inside the payroll system, the kind of deduction that normally exists because a court, a tax authority, or a creditor has ordered a portion of an employee’s paycheck withheld and sent somewhere else. She set up garnishments that weren’t real, attached to obligations that didn’t exist, and had the electronically withheld money routed to herself or to accounts she controlled instead of to whatever agency a legitimate garnishment would have gone to. To keep the books from showing an obvious hole, she kept separate general ledgers and buried the transfers among legitimate payments in parts of the company’s accounting that had nothing to do with payroll.

Eight years is long enough that this wasn’t a lucky one-time slip past a distracted reviewer. It was a sustained, repeated abuse of a transaction type that almost nobody thinks to scrutinize, because a garnishment doesn’t look like spending. It looks like compliance.

Why the gap existed

Every fraud in this series so far has involved someone finding the one category of transaction inside an ERP that gets less scrutiny than everything around it. Vendor payments get checked because vendors are an obvious fraud vector. Payroll runs get checked because payroll is where the big recurring dollar figure lives. Garnishments sit in an odd spot: they’re a payroll transaction, but they’re not compensation. Money leaves the company because a third party outside the company demanded it, under legal authority nobody at the company is positioned to second-guess.

That’s exactly the property that makes them a poor fraud vector to defend and a good one to exploit. A reviewer looking at payroll for anomalies is watching for wages that look too high, or a name that shouldn’t be there. A garnishment reduces what an employee gets paid. It’s the kind of line that reads as a control working correctly, someone’s wages are being properly withheld, rather than a line that might itself be the fraud. Marshall wasn’t hiding a payment. She was hiding a deduction that had no real court order, no real creditor, and no real destination behind it, dressed as the most boring kind of payroll transaction there is.

The second layer, the separate general ledgers, did the rest of the work. Once the garnishment existed inside payroll, anyone glancing at an employee’s pay stub would see a deduction and assume it was legitimate without a case number in front of them. And anyone glancing at the company’s actual books would see a payment that had already been folded into unrelated accounts, nowhere near the payroll categories an auditor would normally check first.

Controls that would have caught it

Garnishment verification against the actual order. Every garnishment in the payroll system should trace back to a specific court order, IRS levy, or creditor judgment with a case number, an issuing authority, and an end date, verified against that source at setup and periodically afterward. A garnishment with no verifiable underlying order shouldn’t be payable at all.

Independent review of garnishment destination accounts. The account receiving a garnishment payment needs to be an external, verified payee, a court registry, a state agency, a named creditor, not an account that traces back to an employee inside the company processing the transaction. That single check, does the destination account belong to the person who set up the deduction, would have flagged this scheme in its first year.

Reconciliation that treats every ledger as one ledger. Marshall’s cover depended on the company having accounting areas siloed enough that transfers buried in one place didn’t get compared against the payroll system generating them. Any reconciliation process that only checks payroll against payroll, and accounts payable against accounts payable, leaves exactly the seam she used for eight years.

An AI prompt example for ERP fraud detection

Garnishments are a transaction type most fraud-detection effort skips entirely, because they look like an outflow the company doesn’t control rather than one it does. Against a payroll and garnishment module, a controller could run something like:

“List all active wage garnishments where no matching court order, IRS levy record, or creditor case number is on file.”

A second query targets the destination-account problem directly:

“Flag any garnishment payment where the receiving bank account matches an account associated with a current employee, particularly an employee with administrative access to the payroll system.”

Neither query requires guessing at intent. It requires treating a garnishment as a transaction with a required paper trail, the same way an invoice needs a purchase order, rather than as a category of spending too dull to check.

The pattern for this series

This series keeps finding the same shape wearing a different transaction type. Somewhere in every ERP there’s a category of movement that reads as routine, procedural, or externally mandated, and routine is exactly what nobody watches closely. Vendor invoices, bank reconciliations, IT asset disposals, and now wage garnishments all share the same vulnerability: the fraud doesn’t need to beat a control. It just needs to find the transaction type that was never considered worth controlling in the first place.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney’s Office for the District of Minnesota, a public government source, along with contemporaneous news reporting on the case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney’s Office, District of Minnesota. “Woman Sentenced to 21 Months’ Imprisonment for Embezzling $1.2 Million from Employer.” Press release, September 22, 2026. https://www.justice.gov/usao-mn/pr/woman-sentenced-21-months-imprisonment-embezzling-12-million-employer

Patch. “Payroll Worker Gets Prison For Stealing $1.2M From MN Truck Company.” https://patch.com/minnesota/across-mn/payroll-worker-gets-prison-stealing-1-2m-mn-truck-company